1. Field of the Invention
The present invention relates to systems and methods for monitoring network events. In particular, but not by way of limitation, the present invention relates to systems and methods for identifying attack preparation activities and/or successful network attacks.
2. Relevant Background.
Our world and the corporate environment are continually and rapidly changing. Increasing and expanding connectivity, disparate and widely distributed corporate systems, burgeoning new forms of communications, and the proliferation of data, place companies at risk and increase the need for information security.
Man has always collected, preserved, studied, analyzed, disbursed, published, and protected information. With the introduction of the computer into society and its rapid assimilation and growth in society, we have made the computer indispensable in our lives. While information is empowerment, the sheer magnitude of the information we collect, as well as the sensitivity of much of it, necessitates that we be cautious in its maintenance, storage and protection. Furthermore, our society has placed regulations upon our private and business lives necessitating that we are able to access and produce information years after we originally collect and store it, while maintaining complete confidentiality.
Because of the nature and complexity of our information-filled society, there is no standard definition for information security (infosec) but it's generally interpreted as a broad term encompassing many others. In very general terms, information security can be defined as protecting information, usually information that is stored, transported and/or managed using computers, from unauthorized use or access. More specifically, “physical security” deals with the physical protection we provide such as locking a facility or installing burglar alarms. “Network security” and computer security deal with protecting networks, specifically, and computers specifically, respectively.
The CSI/FBI Computer Crime and Security Survey, conducted annually since 1996, indicates a steady rise in the number of security breaches and cyber crimes. These crimes resulted in increased financial losses to the corporations involved and increased awareness that employee crime is also on the rise. While traditional information security methods focus on specific types of network crimes and monitor network activity, they fail to adequately address the actions taking place within the corporation. Studies show that while a large percentage of internal problems result from human errors and omissions, there is a significant increase of incidents due to social engineering, where employees are manipulated and persuaded to divulge proprietary company information.
One result that stands out in the various surveys conducted, is, that as the use of networks and the Internet increases, there is a rise in security breaches and attacks from within. These security breaches are, in some cases, accidental or unintentional. In other cases the breaches result from employees or other corporate insiders that are manipulated by social engineering by an outside attacker. In yet other instances employees are exploiting known vulnerabilities within a company's systems. As a result, there are an increasing number of instances employees are exploiting known vulnerabilities within the company systems.
While it is essential to increase employee security awareness through education and positive social engineering, there is also need to implement comprehensive solutions that include hardware and software to reinforce the security awareness training and social engineering. The larger the network and the more nodes and points of interconnection, the larger the number of vulnerabilities. Furthermore, information on the Internet can be accessed from anywhere in the world in real time. While this ability is good for the spread of information, it also allows for a significant amount of risk to the company network. Hence, it is vital for businesses with internal networks and connections to the Internet to ensure that their networks are secure. This is necessary in order to minimize the risk of intrusions both from insiders and outsiders. By concentrating on the three specific areas of monitoring, maintenance and implementation, companies can enhance their network security.
Currently existing security products tend to address one or two known vulnerabilities, but are not designed to deal with all the different types of vulnerabilities that exist within the company. A combination of products is usually required to protect the company by dealing with the different aspects and vulnerabilities of security. Importantly, these products tend to address vulnerabilities that exist in the hardware/software of the computer systems, and fail to address the information itself.
Until now the effort to fortify the perimeter has been a primary focus. Products such as firewalls are placed between the internal systems and public networks to prevent attacks from outside the organization. Firewalls are devices that monitor information packets and analyze characteristics such as source address/domain, destination address, protocols used in the packet, and the like. The firewall decides whether to forward the packet on to its destination by applying pre-specified rules to each packet. Firewalls have proven effective for limiting attacks from outside a corporate network. However, firewalls are not able to detect or prevent security breaches within a company's network.
Unfortunately, the greater overall threat to the network is from inside the company, rather than outside. Employees generally have legitimate access to the network and are cognizant of the security procedures in place. Using their access and their knowledge of how to circumvent the security in place, internal intruders can cause significant damage to the network. It's also quite common for access to be left open for terminated employees. This sometimes occurs because of negligence or a lack of knowledge, but it results in allowing former, and frequently disgruntled employees to access the network and do damage. In addition to errors and omissions, contributing to significant danger facing a company are Internet connections, social engineering by external attackers, disgruntled workers, and dishonest employees. Monitoring employee network activity can reveal potential and real information security exposure. This task involves maintaining visibility to the content of all forms of network traffic can alert management to the disclosure of company information via e-mail, Web-based e-mail, chat, internet messaging (IM), file transfer protocol (FTP), telnet, and other communication methods that currently exists or are developed in the future. Continually implementing improved procedures for assessing vulnerabilities allows companies to re-evaluate exposure and eliminate the vulnerabilities. Automated tools for network monitoring such as “packet sniffers” have been developed primarily for network troubleshooting. These tools analyze network protocols instead of the information carried by the various protocols and are used to assist network managers in identifying and resolving systemic network problems.
The more dangerous security breaches, however, tend to be acute, not systemic. Trusted employees who inadvertently do something wrong on an insufficiently protected system, disgruntled employees and former employees with an “axe to grind,” pranksters who “break” weak passwords, and developers who leave backdoors in applications, all contribute to significant problems, damage, and monetary loss to organizations. As a result, these tools have limited usefulness as a primary tool for identifying inadvertent or intentional security breaches. Instead, companies rely primarily on acceptable use policies and continuous education of employees as to compliance with those policies. However, even the most diligent education and social engineering programs are not totally effective. A need exists for easy-to-use systems for monitoring internal network usage that is readily adaptable to new protocols and new security breaches.
Intrusion detection systems (IDS) come in two alternatives—NIDS (Network IDS) and HIDS (Host IDS). NIDS are usually deployed via security appliances that plug into the network or software that is installed on commercial off-the-shelf (COTS) computers. A NIDS usually has two logical components: a sensor and a management station or console. In its narrowest sense, a HIDS is an IDS that monitors platform and application event logs from multiple sources for suspicious activity. Host computers may include user workstations, peripherals, specialized servers such as Web servers, or network components. One of the limitations of most IDS solutions is their reliance on a limited database of known attack signatures. While some IDS solutions also analyze specific protocols for anomalies, they fall short of recognizing a substantial amount of illicit network activity, as they are unable to view and analyze the full content of network traffic.
Historically viruses have been defined as programs used to infect the operation of a computer system. Virus code may be written and buried within an existing program. Viruses can range from pranks that display a message on screen to programs that destroy programs and data. A particular virus can be characterized by a “signature” which is often a value that is taken from or derived from a portion of the binary code making up the virus. Virus scanning software looks for the signatures of known virus code and takes remedial action to warn users and/or prevent execution of the code. However, viruses are constantly evolving into new configurations that frequently overlap, blurring the definition and increasing the difficulty in diagnosing and eradicating them. Estimates are that thousands of new viruses appear daily.
Firewalls and email systems often include integrated virus scanning software to address virus code entering from outside a corporate network. However, once virus code is inside a network, either intentionally or inadvertently, detecting and containing the threat is more problematic. Virus scanning software on individual desktop computer and workstations is useful to contain a virus, but can be readily disabled either intentionally or inadvertently by a user. Moreover, ensuring that all workstations throughout an organization have up-to-date virus signature files is problematic. Additionally, an intentional attack may use virus code for which no signature yet exists, thereby rendering virus scanning software ineffective.
Blocking and filtering solutions involve techniques that protect an internal network by selectively cutting off access. Blocking may refer to a database of forbidden URLs or blocking of certain communication ports. Filters attempt to analyze requested pages or the content of e-mail headers. Of the variety of blocking and filtering solutions available for networks, some come with the operating system and others can be purchased separately. Unfortunately, blocking filtering solutions can be readily circumvented. For instance, companies frequently install blocking software that doesn't permit their employees to access certain Web sites that they disapprove of (i.e. pornographic). However, an employee can do a search for free Web-mail and get thousands of hits. It is only a matter of trying a few before the employee discovers one that is not blocked by the installed blocking software. Thus, it's possible to circumvent the blocking and filtering software and import or export information without company knowledge and approval.
Significantly, all of these systems tend to be reactive, not proactive. In other words, they are designed to detect a security breach after it occurs and may include tools to aid in the forensic analysis of a completed or ongoing attack. However, they do not include tools to proactively identify an attack before it occurs. Accordingly, a need exists for software, systems and methods that can predict an intrusion detection and enable remedial action before a security breach has occurred within a network.